propose_migration_or_edit · Safe Migrations MCP

WHAT IT DOES

What propose_migration_or_edit does on Safe Migrations

AI agents use propose_migration_or_edit to create or update resources in Safe Migrations — usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Safe Migrations environment.

WHY IT NEEDS A POLICY

Why propose_migration_or_edit needs a policy

The tool creates or proposes database migrations and edits to configuration, which is a reversible Write operation. It does not execute the changes (that is sibling tool apply_change's role) nor does it delete data (destructive). The gatekeeper pattern with confirmation tokens limits risk.

From the tool's definition Tool name includes 'propose_migration_or_edit' indicating creation/modification capabilities. Server description states it 'acts as a gatekeeper for database and configuration changes' with 'proposals, dry-run simulations, and confirmation tokens before…

Attacks that exploit this kind of access

Recommended rule Ready

Verdict

propose_migration_or_edit Rate-limited

propose_migration_or_edit stays usable, but capped — an agent stuck in a loop can't make hundreds of changes a minute. Everything else on the server is denied unless you say otherwise.

View as policy code

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "propose_migration_or_edit": {
      "limits": [
        {
          "counter": "propose_migration_or_edit_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}

LIMIT THIS TOOL →

Instant setup, no code required.

PolicyLayer is an MCP gateway: every tool call is checked against your rule before it reaches Safe Migrations, so you can run agents against it safely.

FAQ

Questions about propose_migration_or_edit

What does the propose_migration_or_edit tool do? +

propose_migration_or_edit. It is categorised as a Write tool in the Safe Migrations MCP Server, which means it can create or modify data. Consider rate limits to prevent runaway writes.

How do I enforce a policy on propose_migration_or_edit? +

Register the Safe Migrations MCP server in PolicyLayer and add a rule for propose_migration_or_edit: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Safe Migrations. Nothing to install.

What risk level is propose_migration_or_edit? +

propose_migration_or_edit is a Write tool with medium risk. Write tools should be rate-limited to prevent accidental bulk modifications.

Can I rate-limit propose_migration_or_edit? +

Yes. Add a rate_limit block to the propose_migration_or_edit rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block propose_migration_or_edit completely? +

Set action: deny in the PolicyLayer policy for propose_migration_or_edit. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides propose_migration_or_edit? +

propose_migration_or_edit is provided by the Safe Migrations MCP server (possibly6/safe-migrations-mcp). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.